jelmer vulnerabilities

Newest CVEs

• CVE-2026-122299

  Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

  jelmer · dulwich

  High8.6
• CVE-2026-114098

  Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

  jelmer · dulwich

  High7.3
• CVE-2026-114097

  Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

  jelmer · dulwich

  High7.3
• CVE-2026-114096

  Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

  jelmer · dulwich

  High7.3
• CVE-2026-114095

  Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

  jelmer · dulwich

  High7.1
• CVE-2026-114094

  Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

  jelmer · dulwich

  High8.7
• CVE-2026-52726

  Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

  jelmer · dulwich

  High7.5
• CVE-2026-47734

  Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

  jelmer · dulwich

  Medium5.7
• CVE-2026-47712

  Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`

  jelmer · dulwich

  Low3.3
• CVE-2026-42305

  Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

  jelmer · dulwich

  High8.8